Privacy

What we ask for

When you place an order the site keeps:

• Your name — it goes on the box and on the collection list.
• Your phone number — the only way we can reach you on the day if a bake runs late or a rider cannot find you. WhatsApp only works if you message us first, so the number is asked for on every order.
• Your delivery address, and the unit or floor separately, when you choose delivery. Not asked for, and not stored, if you choose pickup.
• Any note you type — "not too dark", or the message for a gift card.
• The order itself: what you chose, the collection date, the total, and whether it is paid.
• Where you came from — the advertising tags on the link you arrived by, or the site that linked you. It is how we tell which advertising is paying for itself. Nothing in it identifies you.

What we never hold

Your card number, and anything like it. Payment happens on the payment provider's own page, not ours — the site sends them an amount and a reference, and is told back only whether the payment succeeded. We could not show you your own card number if you asked.

We do not ask for your email address, your date of birth, or an account password. There are no accounts on this site.

Why we hold it

To bake the order and hand it over: the name, the date, the items. To reach you about that order: the phone number. To get it to you: the address, which is also what the delivery fare is worked out from before you pay.

We do not sell any of it, and we do not send marketing messages to the numbers on orders.

How long we keep it

Orders older than 45 days are deleted from the order store, along with the private link that opened them.

Said precisely, because the precise version is the honest one: the clean-up is not a clock, it runs when the next order is placed. So an order can sit a little past its 45th day — until whenever the next customer orders — and is then gone.

Records the business is required to keep — what was sold and what was paid — are held by the payment providers under their own terms, not by this site.

Who else sees it

The owner, through a password-protected back office, to bake and pack the day's orders. Nobody else at SCOF, because there is nobody else.

Beyond that, these services, each for one job:

• toyyibPay and Stripe — taking the payment. They see what a payment page needs: the amount, a reference, and whatever you type on their page. Your card details are theirs, never ours.
• Upstash — the database the order is stored in.
• Vercel — the hosting this site runs on, which sees the requests your browser makes.
• Resend — sends one email to the shop's own inbox telling the owner a new order came in. That email contains the order, including your name and address. It goes to us, not to you.
• Google — address suggestions while you type, and the distance from the kitchen to that address so the fare can be worked out. Google sees the address; it does not see your name or your order.
• Sentry — error reports, when something on the site breaks. Names, addresses, phone numbers and the customer note are stripped out before a report leaves our servers.
• Google Analytics and the Meta (Facebook) pixel — on the public pages, to count visits and to measure advertising. They receive pages viewed and events like "started checkout", not your name, phone or address.
• Meta (Facebook), once more, when a payment goes through — online, or when we record your transfer or cash payment by hand — to measure our advertising. Our server tells Meta the order amount and what was in it, along with your phone number in hashed form (a one-way code, not the number itself), the Meta pixel's own cookie and your browser type from when you ordered. Meta never receives your name or address.

Cookies and what your browser stores

If you arrive from an advertisement, the site keeps a note of which one in your browser's own storage, so an ad clicked on Monday can still be credited with an order placed on Thursday. It stays in your browser and holds nothing about you.

Google Analytics and the Meta pixel set their own cookies for their own counting. Clearing your browser's site data for scof.my clears all of it, and blocking those two in your browser or an extension does not stop you ordering.

Asking us to delete it

Message us on WhatsApp at 018-326 9974 with your order reference — the four characters on your confirmation — and say what you want done. We can tell you what an order holds, correct it, or delete it.

An order that has not yet been collected cannot be deleted and still baked, so deleting one cancels it. Anything a payment provider is required to keep, we cannot delete for them.

Changes to this page

If what we collect changes, this page changes with it and the date at the top moves. There is no mailing list to tell you on, which is also why there is a date at the top.